Skip to content

TorusGuard v2.1.0: First-Principles Security Suite, Tri-Mode Parity & Architecture Flowcharts

Choose a tag to compare

View all tags
@githubmofo githubmofo released this 26 Sep 14:10
· 5 commits to main since this release
v2.1.0
a6866ad

TorusGuard v2.1.0: First-Principles Security Suite, Tri-Mode Parity & Architectural Flowcharts

Release Version: v2.1.0
Release Date: September 26, 2026
Package Manager: npm install -g torusguard@2.1.0
NPM Package: torusguard@2.1.0
GitHub Packages: @githubmofo/torusguard@2.1.0
Binary Engine: Zero-dependency Go 1.25 Single Binary (cmd/torusguard)

Executive Summary

TorusGuard v2.1.0 delivers a major architectural expansion, introducing the First-Principles Security Suite (inspired by foundational systems engineering), upgrading the rule catalog to 86 rules across 22 architectural families, expanding the native Model Context Protocol (MCP) server to 10 tools and 2 living resources, and standardizing visual architecture flowcharts.

This release also decouples the bulky rules table from the main README into dedicated governance catalogs (AGENTS.md and rules/), optimizing documentation scannability while providing a comprehensive multi-tier flowchart of the TorusGuard engine.

Key Highlights & Innovations

┌─────────────────────────────────────────────────────────────────────────────┐
│                          TORUSGUARD v2.1.0 MILESTONES                       │
└─────────────────────────────────────────────────────────────────────────────┘
  1. First-Principles Suite     ──► Native Container, Git Mine, ReDoS & AI Guard
  2. 86 Rules Across 22 Families──► Extended from 74 rules across 18 families
  3. 21 Terminal CLI Commands   ──► Standardized 75-column visual box formatting
  4. 10 Native MCP Tools        ──► Stdio JSON-RPC 2.0 interface for AI assistants
  5. Multi-Modal Vision OCR     ──► Tesseract v5.4.0 image scan with 10MB bounds
  6. Tri-Mode Operational Parity──► Mode A (CLI), Mode B (Chat), Mode C (MCP)
  7. Ponytail Bounds Protocol   ──► Surgical diffs (≤35 additions, ≤25 deletions)
  8. Architectural Flowcharts   ──► Decoupled README with end-to-end Mermaid flows

Detailed Feature Breakdown

1. First-Principles Security Suite

Inspired by deep systems engineering across Docker, Git internals, regular expression DFA/NFAs, and neural RAG pipelines:

  • Container Hardening (internal/scanner/container.go):
    • TG-CONT-001: Root user default detection in Dockerfiles and Containerfiles.
    • TG-CONT-002: Host Docker socket exposure (/var/run/docker.sock).
    • TG-CONT-003: Privileged container flags (privileged: true, SYS_ADMIN).
    • TG-CONT-004: Build-time secret injection in ARG or ENV directives.
  • Git History Secret Mining (internal/scanner/git_mine.go):
    • TG-GIT-001: Historical committed secrets across past git commit diffs (git log -p).
    • TG-GIT-002: Plaintext remote credentials embedded in .git/config URLs.
    • TG-GIT-003: Sensitive keys (.env, id_rsa, .pem) tracked in git metadata.
  • ReDoS Complexity Analysis (internal/scanner/redos.go):
    • TG-REDOS-001: Nested quantifiers (a+)+ causing $O(2^n)$ exponential catastrophic backtracking.
    • TG-REDOS-002: Overlapping alternations with outer repetitions causing polynomial blowup.
  • AI Agent & RAG Pipeline Protection (internal/scanner/ai_guard.go):
    • TG-RAG-001: Unpartitioned vector similarity lookups missing tenant metadata scoping.
    • TG-RAG-002: Indirect prompt injection from raw RAG document chunk ingestion.
    • TG-RAG-003: Vector document poisoning and unsanitized embeddings.
    • TG-AGENT-001 - 004: Direct prompt injection and unsandboxed tool executions.

2. 21 Terminal CLI Commands (75-Column Visual Format)

All commands adhere strictly to visual 75-column box formatting with Unicode emoji width calculation:

  • init, status, audit, verify, harden, apply, rollback, recheck, report, recipes, authorize, web-validate, exploit-check, ocr-scan, container, git-mine, redos, ai-guard, mcp, update, help.

3. Native Model Context Protocol (MCP) Expansion (10 Tools + 2 Resources)

  • torusguard_audit: Full polyglot static AST scan & OCR vision scan.
  • torusguard_ocr_scan: Optical text analysis for leaked credentials in diagrams.
  • torusguard_container: Containerfile & Docker Compose privilege and root user audit.
  • torusguard_git_mine: Git commit log and config secret mining.
  • torusguard_redos: Regular expression exponential backtracking complexity analysis.
  • torusguard_ai_guard: AI agent prompt injection and vector tenancy isolation audit.
  • torusguard_verify: Asserts evidence sufficiency & line-shift invariant fingerprint matches.
  • torusguard_harden: Validates remediation diff against Ponytail Protocol bounds.
  • torusguard_recheck: Differential re-scan confirming fix closure.
  • torusguard_status: Workspace posture and tech stack inspection.
  • Resources: torusguard://security_report and torusguard://rules_catalog.

4. Canonical Skills & Workflows (v2.1.0)

Synchronized 18 skills across .torusguard/skills/, skills/, and skills/torusguard/payload/skills/ with:

  • Tri-Mode execution tables (Terminal CLI, Chat Slash Commands, Native MCP Tools).
  • 5 domain-specific LLM traps per skill.
  • Pre-Flight Self-Audit checklists.
  • VBC Protocol (Verify → Build → Confirm).

Upgrading

# Upgrade via npm
npm install -g torusguard@2.1.0

# Run in any repository
torusguard init
torusguard audit
Assets 2
Loading